passbolt/passbolt_api · error · InternalErrorException

The configuration value should be a string or NULL.

Error message

The {0} configuration value should be a string or NULL.

What it means

assertJwkDefaultAlg() validates the passbolt.plugins.sso.security.jwks.defaultAlg configuration used when a JWK omits its 'alg' parameter. Only string values or NULL are acceptable; any other type (int, bool, array) makes getJwtVerificationKeys() abort with this InternalErrorException.

Solutions

1. Set passbolt.plugins.sso.security.jwks.defaultAlg to a string such as 'RS256' or remove it entirely (NULL) in config/passbolt.php
2. Dump Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg') with var_dump to check the actual type
3. Fix env-based config so values are strings, e.g. use (string)getenv(...) or quote the value
4. Run ./bin/cake passbolt healthcheck after changing the config to confirm it validates

Example fix

// before
'jwks' => ['defaultAlg' => 256],
// after
'jwks' => ['defaultAlg' => 'RS256'],

$defaultAlg = Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg');
if (!is_null($defaultAlg) && !is_string($defaultAlg)) {
    throw new \InvalidArgumentException('defaultAlg must be a string or null');
}

When it happens

Trigger: The config key passbolt.plugins.sso.security.jwks.defaultAlg is set to a non-string, non-null value — e.g. an integer, boolean, or array in config/passbolt.php or via a wrongly-typed environment substitution.

Common situations: Typo in config where a boolean or number is used as the algorithm; dynamic env parsing converting a value to a non-string; copy-pasted config from another setup with wrong types.

Related errors

• The configuration value should be one of the following: .
• Cannot parse JWKS endpoint response.
• Cannot parse JWKS endpoint response.
• Failed to public key properties from certificate
• Failed to read certificate

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/68889818c7e8db89. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php:312

    /**
     * Returns the alg of the keys.
     *
     * @return mixed
     */
    protected function getJwksDefaultAlg(): mixed
    {
        return Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg');
    }

    /**
     * @param mixed $defaultAlg Value to assert.
     * @return void
     * @throws \Cake\Http\Exception\InternalErrorException When configuration value is invalid.
     */
    private function assertJwkDefaultAlg(mixed $defaultAlg): void
    {
        if (!is_null($defaultAlg) && !is_string($defaultAlg)) {
            throw new InternalErrorException(__(
                'The {0} configuration value should be a string or NULL.',
                'passbolt.plugins.sso.security.jwks.defaultAlg'
            ));
        }

        /**
         * "alg" (Algorithm) Header Parameter Values for JWS.
         *
         * @link https://datatracker.ietf.org/doc/html/rfc7518#section-3
         */
        $allowedAlgValues = ['HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES384', 'ES256'];
        if (is_string($defaultAlg) && !in_array($defaultAlg, $allowedAlgValues)) {
            throw new InternalErrorException(__(
                'The {0} configuration value should be one of the following: {1}.',
                'passbolt.plugins.sso.security.jwks.defaultAlg',
                implode(', ', $allowedAlgValues)
            ));
        }

View on GitHub (pinned to 31c1bbc10f)